makefile-validator

The script appears to be a legitimate Makefile validation tool and contains no clear malicious payload, data exfiltration, credential theft, persistence, or sabotage. It has meaningful security risks when used on untrusted Makefiles because GNU make and auxiliary validators may evaluate Makefile expressions or included content. Runtime installation of the unpinned mbake package from a public package index is a supply-chain risk. Pin and verify package versions, use a trusted internal index, sandbox parsing, avoid executing validators on hostile files, and strengthen cleanup path validation.